Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-46402Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory
High 8.1
In plain English
A high-severity path traversal in UFO from microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 45.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in task_name and cause UFO to create log directories and log files outside the intended logs/ directory.
Affected products (as reported)
Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
References
- https://github.com/microsoft/UFO/security/advisories/GHSA-whcg-fgpx-76f2 x_refsource_CONFIRM